US 20110030037 A1
The present disclosure is directed to providing a network user the ability to travel between different zones or locations within a network environment, such as, for example, a hospitality location, without requiring a user to re-login to the new location, while requiring a user to re-login to other locations within the network environment.
1. A method for determining whether to allow a network user communicating with a first access location within a privately controlled computer network including multiple access locations to migrate from one access location to another access location without re-authentication, the method comprising:
providing a plurality of network access locations configured to provide one or more user device's access to a privately controlled computer network;
defining migration permissions for migrating between individual network access locations in the plurality of network access locations, where the migration permissions establish migration rights between individual network access locations in the plurality of network access locations without requiring a user to re-login;
allowing a user device to migrate from communicating with a first network access location in the plurality of network access locations to a second network access location in the plurality of network access locations without requiring the user to re-login; and
requiring the user to re-login when migrating from the first network access location to a third network access location.
2. The method of
3. The method of
4. The method of
5. The method of
6. The method of
7. The method of
8. A system for providing computer network access in a secure computer network including a plurality of computer network access points, the system comprising:
one or more network management devices configured to provide network communications services for one or more network enabled devices; and
a plurality of network access points configured to provide communications portals for facilitating communications between the one or more network management devices and the one or more network enabled devices, the one or more network access points are controllable by the one or more network management devices to allow or deny communications via a second network access point of the plurality of network access points based on an authorization to use a first network access point of the plurality of network access points.
9. The system of
10. The system of
11. The system of
12. The system of
13. The system of
14. The method of
15. A method of providing a user the ability to move between different locations of network access without requiring re-authentication comprising:
defining one or more zones, each zone including a plurality of network access locations;
allowing a network user to move from a first network access location in the plurality of network access locations to a second network access location in the plurality of network access locations without requiring re-authorization to access the second network access location, where the first network access location and the second network access location form part of a first zone in the one or more zones; and
requiring re-authentication from the user when moving from either the first or second network access locations to a third access location, where the third access location is not part of the first zone.
16. The method of
17. The method of
18. The method of
19. The method of
20. A system which provides access rights to a secure computer network based on a physical location of a user, the system comprising:
a network interface configured to communicate with one or more network enabled user devices and to communicate with other network devices, the network interface configured to provide communications between the one or more network enabled user devices and the other network devices;
a database configured with location dependant network access rights; and
a processor in communication with the network interface and the database, the processor configured to allow or deny network communications through the network interface based on a first location dependant authorization for a network enabled user devices at a first location to communicate through the network interface, the processor further configured to allow communications for the network enabled user device at a second location without re-authorization and require reauthorization for the network enabled user device at a third location.
21. The system of
22. The system of
23. The system of
24. The system of
25. The system of
26. The system of
27. The system of
28. The system of
The present disclosure relates to the field of providing computer network access.
The use of laptop, cell phone, PDA and other mobile computing devices has become very common. Travelers, and particularly business travelers, expect and often require network access, such as access to the Internet, as they travel from one place to the next. Similarly, students in schools and doctors in hospitals require access throughout a their respective campuses or medical buildings. Even in a single venue, such as a hotel or conference center, travelers and guest desire network access at various locations throughout the venue including guest rooms, restaurants, meeting rooms, lobby, business centers, etc.
The present disclosure is directed to providing a system for controlling network access in different physical locations of a network. In an embodiment, the disclosure describes a system for controlling access in a network for user moving between different physical locations of the network. For example, in an embodiment, when a user moves between different rooms in a particular venue, the system implements rules which establish when the user will be automatically authenticated to the new location, or whether a new authentication is necessary.
In an embodiment, network access is controlled by implementing different authentication rules for different network access points. A network access point is any wired or wireless connection point to a network. In an embodiment, a network access point is a wired or wireless port. Ports can include, for example, 802.1Q VLAN IDs or the like, TCP ports or the like, UDP ports or the like, and any other software defined communication endpoints. In an embodiment, a network access point is a physical connection to the network, such as, for example, an Ethernet jack, a phone jack, a wireless router, or the like. An access point can also include any form of location identification, such as, for example, the triangulation of a wireless signal, the use of a global positioning system (GPS), or any other system for determining the location of a network user.
In an embodiment, access points are grouped into zones. In an embodiment, a zone includes one or more access points. In an embodiment, a network includes at least a plurality of zones. In an embodiment, a network administrator can configure access rules for allowing a user to move between access points within a zone and/or between zones. In an embodiment, for example, a user is allowed to move from access point to access point within a zone without having to re-authenticate. However, a user may be required to re-authenticate when moving between access points associated with different zones. This can be useful, for example, when a user is required to pay different amounts to access the network through access points in different zones or where different zones have different security levels associated with them. As used in the present specification, authentication can include, for example, a login, including a user name and/or password, the payment of a fee, the registration of a computer, entering a passcode or any other affirmative action taken by a user of a user device to gain permission to use a network.
For purposes of summarizing the disclosure, certain aspects, advantages and novel features of the inventions have been described herein. It is to be understood that not necessarily all such advantages can be achieved in accordance with any particular embodiment of the inventions disclosed herein. Thus, the inventions disclosed herein can be embodied or carried out in a manner that achieves or optimizes one advantage or group of advantages as taught herein without necessarily achieving other advantages as can be taught or suggested herein.
The drawings are provided to illustrate embodiments of the inventions described herein and not to limit the scope thereof.
The network management device(s) 103 provide the ability to group the access points together for purposes of allowing a user device to move between certain access points without requiring re-authentication while requiring re-authentication when moving to other access points. The grouping of access points can be made, for example, along physical boundaries such as, for example, a wall. This can be done, for example, by allocating certain access points to a defined zone. In an embodiment, a zone is a room, group of rooms, building, group of buildings or the like. For example, the lobby 107 can be a first zone, the conference center 109 can be a second zone and the guest room 111 can be a third zone. In a simple example, a user device will be able to move between access points within a zone without having to re-authenticate, but will be required to re-authenticate when moving between access points located in different zones. Authentication, can include, for example, a login, payment of fees, a request for access, entry of a code, or any other action required by the user to request access to the network. In another example, a user device, once authenticated to the lobby zone 107 can be allowed to access the conference center zone 109 without reauthentication, but may be required to re-authenticate when moving to the guest room zone 111.
In an embodiment, access points advertise their presence by broadcasting a Service Set Identifier (SSID), Extended Service Set Identifier (ESSID), and/or Basic Service Set Identifier (BSSID), or the like, collectively referred to herein as SSID. In an embodiment, the same SSID is assigned to all access points and zones in a network. In an embodiment, a different SSID is assigned to each zone or to a group of zones. In an embodiment, multiple SSID's can be assigned to the same zone or same set of access points. In this respect virtual SSID's can be set up corresponding to different groupings of zones or access points. For example, at the same hotel or conference center, two different conferences which are simultaneously occurring can have custom SSID's corresponding to the access grated to each group. Conference A2 2009 for example can have a custom SSID entitled “Conference A2 2009” which allows access to access points in the Lobby, Guest Rooms and Meeting Rooms without re-authentication, but not in the Business Center. A second conference, Conference B1 2009, can also have a custom SSID entitled “Conference B1 2009” which allows access to the Lobby, Meeting Rooms, Guest Rooms and the Business Center without re-authentication. Similarly, network providers can also have various levels of SSIDs allowing access to different groups of access points where multiple SSIDs correspond to the same access point or zone. Different SSIDs can correspond to different payment levels. For example, an inexpensive SSID access may only grant access to the Lobby, whereas a more expensive SSID can grant access to the Business Center or Meeting Rooms.
In an embodiment, an amount of bandwidth, or maximum bandwidth can be assigned to different access points, groups of access points, zones, groups of zones or custom SSIDs.
The following is a non-limiting example of Zone Migration. As used in this example, a zone is a group of VLAN IDs. When customers connect to the network, for example, at a hotel, they are authenticated in one of four zones:
Devices are generally programmed to automatically select between access points, by, for example, determining which access point provides the strongest signal. User device 356 is in-between three different access points and is able to communicate with all of them, but will eventually choose one access point to communicate with. In some cases, an access point will not allow a device to communicate through it, in which case the user device will attempt to communicate with another the access point. For example, user device 357 may have the strongest signal with access point 325, but may only be authenticated with access point 337. In this case, the user devices will communicate with access point 337. Of course, as will be understood, user devices can be configured to select access points based on any number of different selection options, including, for example, signal strength, bandwidth availability, access rights, access points corresponding to a particular SSID, etc. When an access point is out of range, a user device will no longer be able to communicate with it and will attempt to find another access point. In an embodiment, switching between access points is seamless, e.g. there is no loss of network session, and a user may not even realize that they have switched access points.
A relogin after migration selection 403 is provided to allow an administrator to determine whether to require a user to relogin after migrating between access points. An administrator can enter a zone name as desired in entry area 407. The administrator can then input the ports or locations that correspond to that zone in entry area 409. Optionally, an administrator can provide a description in entry area 411. The administrator can then determine whether a relogin (or reauthentication) will be required for moving between access points within the zone at selection 413. With relogin within zone 413 disabled, a user can freely move between access points without having to relogin. Add zone button 415 provides a subsequent screen which allows an administrator to define another zone. Reset button 417 allows an administrator to reset zone settings. Existing zones section 419 lists all previously defined zones for the network with corresponding ports or locations along with the relogin policy for each zone. To modify an existing zone, the administrator can click on the ‘Edit’ link of a particular zone. The fields at the top will then be populated with the attributes of the selected zone (name, ports, description and relogin policy). To remove a zone, the administrator can click on the ‘Delete’ link. A pop-up box will request the confirmation of the delete operation.
In an embodiment, zones cannot overlap, meaning that a port can belong to one and only one zone. In this embodiment, an error will be returned if the administrator enters a new zone that overlaps with an existing zone. In another embodiment, zones can be configured to overlap such that the same port or access location can form part of two or more separate zones.
Many different zone to zone migration policies can be implemented, such as, for example, at the login Portal. In an embodiment, the network can be configured to (1) charge separately for each zone, or (2) allow free migration from “Zone 1” to “Zone 2” after accepting terms and conditions but require a payment when migrating from “Zone 2” to “Zone 1”. Similarly, a single payment can be accepted for a group of zones, but an additional or separate charge could be required for other zones.
Zones can also be set up in other interfaces, such as, for example, command line interface (CLI) and simple network management protocol (SNMP). As would be understood by a person of ordinary skill in the art from the present disclosure, the various options and tools available in the interface embodiment of
In an embodiment, an unlimited number of zones can be configured. In an embodiment, the number of configurable zones is limited by the capacity of the network equipment used. For example, in an embodiment, up to 64 Zones or up to 32 Zones can be configured.
In an embodiment in which the number of zones is limited, if there is already the maximum number of Zones in the configuration, the network device will return a “Maximum number of Zones already reached” error.
In an embodiment, when a zone is added or modified by the administrator, the network device(s) will check for errors in, such as, for example, the zone name; the specified network access locations, such as, for example, the port assignments;
In an embodiment, the zone name is a string of a specified length, such as, for example, between 1 and 16 characters in length. In an embodiment, if this check fails, the network device(s) will return an“Invalid length of Zone Name” error; the zone description; and/or any other variables.
In an embodiment, the Zone Name must be unique. If this check fails, the network device(s) will return a “Zone Name already in use” error.
In an embodiment, the port name is a string of a specified length, such as, for example, between 1 and 128 characters in length (e.g., enough for at least 20 separate ports, or for at least 10 ranges of ports). The string can contain an individual numeric value (e.g., “211”), or a comma-separated list of numeric values (e.g., “211, 212”), or a range of numeric values with dash-separated delimiters (e.g., “111-799”), or a list of ranges of numeric values (e.g., “100-150, 201-700”), or a comma-separated list of individual numeric values and ranges (e.g., “211, 212, 213-651”). In an embodiment, if the string contains non-numeric values, the NSE will return a “Values may only be numeric, comma separated values or ranges” error.
In an embodiment, the numeric values cannot exceed 65535. When ranges are used, the right delimiter cannot be smaller than the left delimiter. In an embodiment, if these checks fail, the network management device will return an “Invalid format of Ports or value greater than 65535” error.
In an embodiment, ports of different zones cannot overlap. In an embodiment, if this check fails, the network devices will return a “Ports may not overlap ranges in other zones. Modify the overlapping zone first or change this entry” error. In an embodiment, ports are allowed to overlap and this check is not performed.
In an embodiment, the description is a string of specified length, such as, for example, between 0 and 128 characters in length. In an embodiment, if this check fails, the network device(s) will return an “Invalid length of Description” error.
In an embodiment, the relogin is a Boolean value in which no checking is necessary. In some WMI embodiments, the above errors will be shown in a pop-up error box, and in some embodiments, the field causing the error will simultaneously be highlighted with a red border.
There are a number of cases to consider when the zone (e.g. port in some embodiments) of the subscriber changes: (1) If the “Relogin after migration parameter” is disabled, the subscriber does not need to relogin; (2) If the “Relogin after migration parameter” is enabled, and no zone is specified, the subscriber will need to relogin; (3) If the “Relogin after migration parameter” is enabled, and one or more zones are specified, the subscriber may need to relogin when: (1) the port changes to that of a different zone; or (2) the relogin policy of the zone is to require relogin.
In an embodiment, ports that do not belong to any of the configured zone are automatically assigned to a “default Zone”. In an embodiment, the absence of a port is also assigned to a “default Zone”. The relogin policy of the “default Zone” is simply derived from the “Relogin after migration” parameter. When the subscriber is re-logged in, and a portal is involved in the relogin process, the zone name will also be sent to the portal along with the other portal parameters (MAC address, room number, etc).
In an embodiment, the Administrator setup page also allows the administrator to set up SSID's corresponding to different zones, groups of zones, access points or groups of access points. In an embodiment, SSID's can be programmed to correspond to overlapping access points or zones. For example, a plurality of SSID's can be assigned to the same access point or zone. The Administrator setup page can also provide for temporary (or permanent) custom SSID's corresponding to a plurality of access points or zones. For example, a conference can be set up with a personalized SSID corresponding to a set of access points or zones.
In an embodiment, the Administrator setup page can also allow an administrator to assign an amount of bandwidth to a particular access point, group of access points, zone, group of zones or SSID. For example, the Lobby may be provided less bandwidth than the Guest Rooms. Similarly, a conference with a custom SSID can be provided a set amount of Bandwidth for users of the custom SSID.
In an embodiment, an administrator can separately define different access rights when moving between zones. For example, in an embodiment, anytime a user moves between zones they are required to login. This type of system is illustrated in
In an embodiment, migration between zones can be further configured to use a “home” authentication or initial authentication location to track migration policy. This allows a user, for example, to move from a first zone to a second zone and back to the first zone without a relogin in a system that generally requires a relogin to move from the second zone to the first zone.
Conditional language used herein, such as, among others, “can,” “could,” “might,” “may,” “e.g.,” and the like, unless specifically stated otherwise, or otherwise understood within the context as used, is generally intended to convey that certain embodiments include, while other embodiments do not include, certain features, elements and/or states. Thus, such conditional language is not generally intended to imply that features, elements and/or states are in any way required for one or more embodiments or that one or more embodiments necessarily include logic for deciding, with or without author input or prompting, whether these features, elements and/or states are included or are to be performed in any particular embodiment.
While certain embodiments of the inventions disclosed herein have been described, these embodiments have been presented by way of example only, and are not intended to limit the scope of the inventions disclosed herein. Indeed, the novel methods and systems described herein can be embodied in a variety of other forms; furthermore, various omissions, substitutions and changes in the form of the methods and systems described herein can be made without departing from the spirit of the inventions disclosed herein. The claims and their equivalents are intended to cover such forms or modifications as would fall within the scope and spirit of certain of the inventions disclosed herein.